Changeset 1032 for trunk/bp-friends/bp-friends-ajax.php

Timestamp:

02/09/2009 06:52:51 AM (17 years ago)

Author:

apeatling

Message:

Added nonce security checks to all BuddyPress actions. Fixes #454

File:

• trunk/bp-friends/bp-friends-ajax.php (modified) (2 diffs)

trunk/bp-friends/bp-friends-ajax.php

@@ -4 +4 @@
     global $bp;
 
-    check_ajax_referer('friend_search');
+    check_ajax_referer( 'friends_search' );
     
     load_template( get_template_directory() . '/friends/friends-loop.php' );
@@ -14 +14 @@
 
     if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( $bp->loggedin_user->id, $_POST['fid'] ) ) {
+        
+        check_ajax_referer('friends_remove_friend');
+        
         if ( !friends_remove_friend( $bp->loggedin_user->id, $_POST['fid'] ) ) {
             echo __("Friendship could not be canceled.", 'buddypress');
         } else {
-            echo '<a id="friend-' . $_POST['fid'] . '" class="add" rel="add" title="' . __( 'Add Friend', 'buddypress' ) . '" href="' . $bp->loggedin_user->domain . $bp->friends->slug . '/add-friend/' . $_POST['fid'] . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
+            echo '<a id="friend-' . $_POST['fid'] . '" class="add" rel="add" title="' . __( 'Add Friend', 'buddypress' ) . '" href="' . wp_nonce_url( $bp->loggedin_user->domain . $bp->friends->slug . '/add-friend/' . $_POST['fid'], 'friends_add_friend' ) . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
         }
     } else if ( 'not_friends' == BP_Friends_Friendship::check_is_friend( $bp->loggedin_user->id, $_POST['fid'] ) ) {
+        
+        check_ajax_referer('friends_add_friend');
+        
         if ( !friends_add_friend( $bp->loggedin_user->id, $_POST['fid'] ) ) {
             echo __("Friendship could not be requested.", 'buddypress');